PolicyCenter installs and uses Sun ONE Directory Server 5.2. This version of the Sun ONE Directory Server has a number of publicly documented vulnerabilities.

The most severe vulnerabilities allow a remote attacker to mount a denial of service attack. Others allow a remote attacker to gain read and write access to specific data stored or managed by the Directory Server.  This data may include PolicyCenter configuration data.

When PolicyCenter is deployed behind a firewall, as is recommended, an attacker must gain access from the internal network in order to mount an attack. The CVSS base scores included in this advisory are based on this deployment scenario.

If PolicyCenter is deployed outside of the firewall. the CVSS base score for all CVEs listed would be higher. The CVSS base score for this security advisory would be a 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C).

PolicyCenter 8.7.2 contains an upgrade to Sun Directory Server version 7.0 that fixes all the CVEs documented in this Security Advisory. Note that Sun Directory Server 7.0 must be installed on Windows Server 2008. When installing PolicyCenter 8.7.2 on a Windows 2000 or 2003 server, Sun Directory Server 5.2 is installed and will still have the security vulnerabilities listed in this advisory.

Note that Sun ONE Directory Server 7.0 does not address CVE-2010-0708. A fix for this vulnerability has not been published. PolicyCenter continues to be vulnerable to CVE-2010-0708.